0.0
NA
CVE-2026-74649
staging: rtl8723bs: fix missing shared-key auth challenge length check
Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.

INFO

Published Date :

Aug. 22, 2026, 4:16 p.m.

Last Modified :

Aug. 22, 2026, 4:16 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-74649 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
Solution
Fix buffer overflow/underfill in shared-key authentication by enforcing challenge length.
  • Require shared-key authentication element to be exactly 128 octets.
  • Ensure challenge length matches WLAN_AUTH_CHALLENGE_LEN.
  • Patch the Linux kernel's rtl8723bs driver.
  • Update the affected driver version.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-74649 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-74649 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-74649 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-74649 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 22, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '39ae1033071001af9bb4573ebdbb43bbbe88f749', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '4d018e7d7d908bdfcb5ecfa922b1d5cb9ddb3722', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '4ba402fd47009d20e51dbfc934abb562098ea35b', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '87c2f073d2aaea041d531b8e579c47570b54b3b7', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': 'a28a4b0592e4a37ea471bc0d308513a93133ce7e', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '6235b5156b48ed5d1ce3410d8f0b2fd67d30d944', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '2c56ef658ac8c6bca36bc5574715e8f717207c6c', 'versionType': 'git'}], 'programFiles': ['drivers/staging/rtl8723bs/core/rtw_mlme_ext.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/staging/rtl8723bs/core/rtw_mlme_ext.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.
    Added Reference https://git.kernel.org/stable/c/2c56ef658ac8c6bca36bc5574715e8f717207c6c
    Added Reference https://git.kernel.org/stable/c/39ae1033071001af9bb4573ebdbb43bbbe88f749
    Added Reference https://git.kernel.org/stable/c/4ba402fd47009d20e51dbfc934abb562098ea35b
    Added Reference https://git.kernel.org/stable/c/4d018e7d7d908bdfcb5ecfa922b1d5cb9ddb3722
    Added Reference https://git.kernel.org/stable/c/6235b5156b48ed5d1ce3410d8f0b2fd67d30d944
    Added Reference https://git.kernel.org/stable/c/87c2f073d2aaea041d531b8e579c47570b54b3b7
    Added Reference https://git.kernel.org/stable/c/a28a4b0592e4a37ea471bc0d308513a93133ce7e
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.